BUG11559: There was no possibillity to select single IpSec subnets (if any) in the firewall creation site. Now the dropdown for IpSec is adapted to reflect the single TARGET subnets.

  Another patch will follow to make these changes in the firewall groups with the language changes ("All subnets" instead of "all")

fixes: #11559
---
 config/firewall/firewall-lib.pl | 19 +++++++++++++++----
 html/cgi-bin/firewall.cgi       | 36 +++++++++++++++++++++++++++++++++---
 2 files changed, 48 insertions(+), 7 deletions(-)
  

On Mon, 2018-04-30 at 08:12 +0200, Alexander Marx wrote:
> Another patch will follow to make these changes in the firewall groups with
> the language changes ("All subnets" instead of "all")

Please submit all patches that belong together as a single patchset.

-M

> 
> fixes: #11559
> ---
>  config/firewall/firewall-lib.pl | 19 +++++++++++++++----
>  html/cgi-bin/firewall.cgi       | 36 +++++++++++++++++++++++++++++++++---
>  2 files changed, 48 insertions(+), 7 deletions(-)
> 
> diff --git a/config/firewall/firewall-lib.pl b/config/firewall/firewall-lib.pl
> index eabd9a4..668eb9e 100644
> --- a/config/firewall/firewall-lib.pl
> +++ b/config/firewall/firewall-lib.pl
> @@ -150,6 +150,9 @@ sub get_ipsec_net_ip
>  	my $val=shift;
>  	my $field=shift;
>  	foreach my $key (sort {$a <=> $b} keys %ipsecconf){
> +		#adapt $val to reflect real name without subnet (if rule with
> only one ipsec subnet is created)
> +		my @tmpval = split (/\|/, $val);
> +		$val = $tmpval[0];
>  		if($ipsecconf{$key}[1] eq $val){
>  			return $ipsecconf{$key}[$field];
>  		}
> @@ -390,10 +393,18 @@ sub get_address
>  
>  	# IPsec networks.
>  	} elsif ($key ~~ ["ipsec_net_src", "ipsec_net_tgt", "IpSec Network"])
> {
> -		my $network_address = &get_ipsec_net_ip($value, 11);
> -		my @nets = split(/\|/, $network_address);
> -		foreach my $net (@nets) {
> -			push(@ret, [$net, ""]);
> +		#Check if we have multiple subnets and only want one of them
> +		
> +		if ( $value =~ /\|/ ){
> +			my @parts = split(/\|/, $value);
> +			push(@ret, [$parts[1], ""]);
> +			
> +		}else{
> +			my $network_address = &get_ipsec_net_ip($value, 11);
> +			my @nets = split(/\|/, $network_address);
> +			foreach my $net (@nets) {
> +				push(@ret, [$net, ""]);
> +			}
>  		}
>  
>  	# The firewall's own IP addresses.
> diff --git a/html/cgi-bin/firewall.cgi b/html/cgi-bin/firewall.cgi
> index face0f4..65e43a1 100644
> --- a/html/cgi-bin/firewall.cgi
> +++ b/html/cgi-bin/firewall.cgi
> @@ -1161,11 +1161,31 @@ END
>  	#IPsec netze
>  	foreach my $key (sort { ncmp($ipsecconf{$a}[1],$ipsecconf{$b}[1]) }
> keys %ipsecconf) {
>  		if ($ipsecconf{$key}[3] eq 'net' ||
> ($optionsfw{'SHOWDROPDOWN'} eq 'on' && $ipsecconf{$key}[3] ne 'host')){
> -			print"<tr><td valign='top'><input type='radio'
> name='$grp' value='ipsec_net_$srctgt'
> $checked{$grp}{'ipsec_net_'.$srctgt}></td><td >$Lang::tr{'fwhost ipsec
> net'}</td><td align='right'><select name='ipsec_net_$srctgt'
> style='width:200px;'>" if ($show eq '');
> +			print"<tr><td valign='top'><input type='radio'
> name='$grp' id='ipsec_net_$srctgt' value='ipsec_net_$srctgt'
> $checked{$grp}{'ipsec_net_'.$srctgt}></td><td >$Lang::tr{'fwhost ipsec
> net'}</td><td align='right'><select name='ipsec_net_$srctgt'
> style='width:200px;'>" if ($show eq '');
>  			$show='1';
> +
> +			#Check if we have more than one REMOTE subnet in
> config
> +			my @arr1 = split /\|/, $ipsecconf{$key}[11];
> +			my $cnt1 += @arr1;
> +
>  			print "<option ";
> -			print "selected='selected'" if
> ($fwdfwsettings{$fwdfwsettings{$grp}} eq $ipsecconf{$key}[1]);
> -			print ">$ipsecconf{$key}[1]</option>";
> +			print "value=$ipsecconf{$key}[1]";
> +			print " selected " if
> ($fwdfwsettings{$fwdfwsettings{$grp}} eq "$ipsecconf{$key}[1]");
> +			print ">$ipsecconf{$key}[1] ";
> +			print "$Lang::tr{'all'}" if $cnt1 > 1; #If this
> Conenction has more than one subnet, print one option for all subnets
> +			print "</option>";
> +
> +			if ($cnt1 > 1){
> +				foreach my $val (@arr1){
> +					#normalize subnet to cidr notation
> +					my ($val1,$val2) = split /\//, $val;
> +					my $val3 =
> &General::iporsubtocidr($val2);
> +					print "<option ";
> +					print
> "value='$ipsecconf{$key}[1]|$val1/$val3'";
> +					print "selected " if
> ($fwdfwsettings{$fwdfwsettings{$grp}} eq "$ipsecconf{$key}[1]|$val1/$val3");
> +					print ">$ipsecconf{$key}[1]
> $val1/$val3</option>";
> +				}
> +			}
>  		}
>  	}
>  	if($optionsfw{'SHOWDROPDOWN'} eq 'on' && $show eq ''){
> @@ -2575,6 +2595,11 @@ END
>  			#SOURCE
>  			my $ipfireiface;
>  			&getcolor($$hash{$key}[3],$$hash{$key}[4],\%customhos
> t);
> +			# Check SRC Host and replace "|" with space
> +			if ($$hash{$key}[4] =~ /\|/){
> +				$$hash{$key}[4] =~ s/\|/ (/g;
> +				$$hash{$key}[4] = $$hash{$key}[4].")";
> +			}
>  			print"<td align='center' width='30%' $tdcolor>";
>  			if ($$hash{$key}[3] eq 'ipfire_src'){
>  				$ipfireiface=$Lang::tr{'fwdfw iface'};
> @@ -2640,6 +2665,11 @@ END
>  			print<<END;
>  					<td align='center' $tdcolor>
>  END
> +			# Check TGT Host and replace "|" with space
> +			if ($$hash{$key}[6] =~ /\|/){
> +				$$hash{$key}[6] =~ s/\|/ (/g;
> +				$$hash{$key}[6] = $$hash{$key}[6].")";
> +			}
>  			#Is this a DNAT rule?
>  			my $natstring;
>  			if ($$hash{$key}[31] eq 'dnat' && $$hash{$key}[28] eq
> 'ON'){